Posted on

Brevo Cloudflare Supply-Chain Attack – ClickFix and WordPress Backdoor Exposure

Threat Overview

Brevo confirmed that attackers obtained a long-lived Cloudflare API key with full account permissions and used it to deploy a malicious Cloudflare Worker. On September 14, the Worker modified Brevo content at the CDN edge and injected malicious JavaScript into Brevo pages and customer-embedded components. Visitors could receive a fake Cloudflare verification page using ClickFix instructions, while logged-in WordPress administrators were targeted with an attempted malicious plugin installation. Because the Worker altered responses at the edge, Brevo origin files remained unchanged.

References

Impacted Systems

Brevo customer websites embedding the Brevo forms script, Conversations widget, SDK loader, or affected hosted forms/pages during September 14, 2026. Confirmed customer-facing exposure was approximately 16:07-20:30 UTC according to Brevo. Windows visitors who followed ClickFix instructions are at risk. WordPress administrators logged into sites embedding affected content were targeted with plugin installation. Brevo states app.brevo.com, its API, email delivery infrastructure, and customer account data were not affected by this edge-injection incident.

Why this matters

This is a verified third-party JavaScript supply-chain compromise with broad downstream reach. It combines trusted CDN delivery, ClickFix endpoint execution, and a WordPress administrator pivot.

Exploitation Status

Confirmed malicious delivery on September 14. Brevo removed the Worker and revoked the compromised key. Exposure does not establish successful infection for every site or visitor.

What this hunt looks for

The hunt focuses on published loader infrastructure, ClickFix-style command execution, WordPress plugin upload and activation during the exposure window, malicious plugin artifacts, and post-execution network activity.

Required logs

Defender XDR DeviceNetworkEvents, DeviceProcessEvents and DeviceFileEvents, plus web, WAF, proxy, or WordPress access telemetry ingested into Microsoft Sentinel.

First Pass – Brevo Malicious Loader Domains

let Domains=dynamic(["cdn.sendibt1.com","cdn2.sendibt1.com","cdn3.sendibt1.com","cdn4.sendibt1.com","cdn9.sendibt1.com","cdn10.sendibt1.com","cdn11.sendibt1.com","yelahaye.surf","boiseno.club"]);
DeviceNetworkEvents
| where Timestamp between (datetime(2026-09-14T15:00:00Z)..datetime(2026-09-15T00:00:00Z))
| where RemoteUrl has_any (Domains)
| project Timestamp,DeviceName,InitiatingProcessAccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

ClickFix Run Dialog Command Execution

DeviceProcessEvents
| where Timestamp between (datetime(2026-09-14T15:00:00Z)..datetime(2026-09-15T06:00:00Z))
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe")
| where InitiatingProcessFileName in~ ("explorer.exe","chrome.exe","msedge.exe","firefox.exe","brave.exe")
| project Timestamp,DeviceName,AccountName,FileName,ProcessCommandLine,InitiatingProcessFileName,InitiatingProcessCommandLine,SHA256
| order by Timestamp desc

WordPress Plugin Upload During Exposure Window

CommonSecurityLog
| where TimeGenerated between (datetime(2026-09-14T15:00:00Z)..datetime(2026-09-15T00:00:00Z))
| where RequestURL has "/wp-admin/update.php"
| where RequestURL has "action=upload-plugin"
| project TimeGenerated,SourceIP,DestinationIP,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

WordPress Plugin Activation During Exposure Window

CommonSecurityLog
| where TimeGenerated between (datetime(2026-09-14T15:00:00Z)..datetime(2026-09-15T00:00:00Z))
| where RequestURL has "/wp-admin/plugins.php"
| where RequestURL has "action=activate"
| project TimeGenerated,SourceIP,DestinationIP,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

Web Media Optimizer or wm.zip Artifacts

DeviceFileEvents
| where Timestamp >= datetime(2026-09-14T15:00:00Z)
| where FileName =~ "wm.zip" or FolderPath has "Web Media Optimizer" or FileName has "web-media-optimizer"
| project Timestamp,DeviceName,FileName,FolderPath,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc

Injected Brevo JavaScript Hashes

let Hashes=dynamic(["58a5c601c9df7ca2120435588fc39f97712d9b878795f6ee500590099a432308","f67d572d2d30407b3f470904326411450763108980cdad89550fbb221fb06782","9b62c12bc5c7feb9802f58e6cf75a368690df3c754e37cc64483a92acacf87a5"]);
DeviceFileEvents
| where Timestamp >= datetime(2026-09-14T15:00:00Z)
| where SHA256 in~ (Hashes)
| project Timestamp,DeviceName,FileName,FolderPath,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc

Network Security Fallback for Loader Domains

CommonSecurityLog
| where TimeGenerated between (datetime(2026-09-14T15:00:00Z)..datetime(2026-09-15T00:00:00Z))
| where DestinationHostName has_any ("sendibt1.com","yelahaye.surf","boiseno.club") or RequestURL has_any ("sendibt1.com","yelahaye.surf","boiseno.club")
| project TimeGenerated,SourceIP,DestinationIP,DestinationHostName,DestinationPort,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

Post-ClickFix PowerShell Network Activity

DeviceNetworkEvents
| where Timestamp between (datetime(2026-09-14T15:00:00Z)..datetime(2026-09-15T06:00:00Z))
| where InitiatingProcessFileName in~ ("powershell.exe","pwsh.exe","cmd.exe","mshta.exe","wscript.exe","cscript.exe")
| project Timestamp,DeviceName,InitiatingProcessAccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

Detection Notes

The exposure window is time-bounded, so the queries focus on September 14. The strongest signals are published loader domains and hashes, plugin upload or activation during the window, and shell execution immediately after browser activity. Loading a Brevo component indicates potential exposure, not necessarily infection. Origin file-integrity monitoring alone could miss the edge rewrite.

Leave a comment